# Larkfield metered discount checks

Larkfield's `discount` tool as a priced native service: each call prices a SKU after a percentage discount and charges USD 0.20 (20 USD minor units). The grant authorizes up to 20 per call and 50 in total, so two calls run and the kernel refuses the third before the handler starts. Charges land in Chio's local operator ledger as USD-denominated credits; no external money moves.

Pull it with `chio new pricing-metered --example pricing-metered`. `rust-toolchain.toml` selects the compiler and Cargo fetches the pinned Chio crates.

```sh
cargo run --release --locked -- sku-204 15
```

The arguments are the SKU (`sku-118`, `sku-204`, or `sku-301`) and the discount in percent; `sku-204` at 15 percent is USD 49.30. Each run creates a private directory under `runs/` with its own signing identity, capability, receipt store, and durable admission authority. The authority owns budget, revocation, and operation state together; a separate local-credit ledger records holds and captures.

- `src/service.rs` defines the tool, its price, and the connection that reports the realized charge through `invoke_with_cost`. Manifest pricing alone is not cost reporting.
- `src/host.rs` defines the per-call ceiling and the total allowance. Keep the price and the per-call ceiling equal: the local adapter captures exactly the authorized amount.
- `src/main.rs` sends three calls, verifies each receipt against the host key, and prints the ledger after each one.

The printed ledger snapshots and handler counts are application observations, separate from the signed receipts. The handler appends one line to `handler-invocations.log` each time it runs; across the three calls the count reads 1, 2, 2, because the refused call never reaches it.

## Export billing records

From the printed run directory:

```sh
cargo run --release --locked --bin export-billing -- . kernel-public-key.txt
```

The collector verifies every receipt against the host key before it derives billing rows, and rejects duplicate IDs, changed records, and allows that did not settle. Refusals stay in the evidence and add no billable row. `cost-metadata.json`, `billing.json`, and `billing.jsonl` are the accounting outputs. `node reconcile-billing.mjs runs/<run-id>` compares those rows against the receipt store through the `chio` CLI.

## Verify one receipt

```sh
cargo run --release --locked --bin verify-receipt -- call-1-receipt.json kernel-public-key.txt
```

For another operator, take the expected key from trusted configuration; a key file that arrives beside the receipts establishes nothing by itself.